An adversarial patch attack method for face recognition

Abstract

The present invention relates to an adversarial patch attack method for face recognition, and belongs to the field of deep learning. The adversarial sample attack method based on adversarial mask patches proposed by the present invention proposes a mask shape that is more suitable for a face recognition model and a concealment generation method that is more suitable for application scenarios compared to a general adversarial patch method, thereby improving the attack robustness of such methods and increasing the possibility of successful attacks in the real world. The main innovation of the present invention is to design a method for generating disturbances for a face recognition system, and the related loss function enhances the concealment of the patch by targeting the dependence of the face recognition network on the embedding vector and by designing the link of style loss, thereby greatly improving the possibility of attacking the real system, and increasing the consideration of concealment factors under the premise of considering the success rate of the method. For example, in real life, an attacker can impersonate other identities for face verification, and steal other people's account information after passing. The attack method proposes a concealment-related evaluation standard for defense.

Description

Technical Field

[0001] The present invention belongs to the field of deep learning and relates to an anti-patch attack method for face recognition. Background Art

[0002] Adversarial sample attack methods refer to adding local or global disturbances that are not easily perceived by the naked eye to the original input image in order to interfere with the judgment of the input by deep learning networks such as classification or regression. It usually exists in the image through extremely small noises, which are specially formulated by taking advantage of the complex iterative structural characteristics of the network. By taking advantage of the characteristics of gradients, output vectors, etc., iterative input images can induce network misjudgment. The existence of adversarial sample attacks poses a great potential threat to the vast majority of identity verification systems, autonomous driving systems, and target detection systems on the market. Researching and proposing corresponding attack methods has brought great value to the successful defense and strengthening of networks in practical applications.

[0003] At present, the methods of adversarial samples can be divided into two types: local attack methods and global attack methods. The global attack method is to cover the entire input image with a layer of generated adversarial noise, thereby turning the original input image into an adversarial sample. This method is of little significance in real life, because it is difficult for attackers to capture and modify relevant images before entering the system. The local perturbation attack method is easier to migrate to the physical world. It tampered with the input image in the form of hiding a tiny adversarial patch in a local area of ​​the input image, thereby inducing the network to make wrong judgments. This type of patch-shaped perturbation is more conducive to migration to the real world, thus posing a great threat to real-world applications. Since these adversarial sample methods do not require operating the network and training set, but only tampering with the test samples, they are less difficult to implement. Studying these attack methods can more effectively add corresponding defenses to applications and improve the robustness of the system.

[0004] Existing patch-based attack methods all generate perturbations on network gradients. Since deep learning networks infer the final results through continuous iteration and convolution, the output results of each layer will be calculated as the input of the next layer. Therefore, by designing a loss function in the opposite direction of the original correct category gradient, it is possible to effectively mislead each layer of the network to judge the correct category, thereby accumulating and eventually making the final judgment wrong. Most existing methods use this idea to design the loss function of iterative patches and ignore the consideration of the concealment of the generated patches, which is also one of the important criteria for considering the effectiveness of a patch. Summary of the invention

[0005] In view of this, an object of the present invention is to provide a method for countering patch attacks for face recognition.

[0006] In order to achieve the above object, the present invention provides the following technical solutions:

[0007] A method for countering patch attacks for face recognition, the method comprising the following steps:

[0008] S1: Select random patches for preprocessing, cut out the mask shape and splice it with the input class original image, and simulate the image of the mask on the face as the initial input;

[0009] S2: The generated image and the original image are submitted to the network for feature extraction, and the mapping vector outputs of the two images are obtained respectively, and the eigenvalues ​​are recorded;

[0010] S3: Substitute the output vector of the synthetic image of the adversarial patch and the output vector of the real class into the loss function calculation, update the patch pixels according to the gradient direction and generate a new adversarial patch;

[0011] S4: Iterate and repeat the first step until the set iteration number threshold is reached, and output the final adversarial patch.

[0012] Optionally, in S4, the iteration method is to repeat the training for each image x m times continuously, reuse the gradient of the previous step when calculating the perturbation r, and divide the entire epoch by m to ensure speed and enhance concealment; wherein the update formula of r is:

[0013] r t+1 =r t +∈·sign(g)

[0014] Where sign(g) represents the gradient direction, ∈ is a preset hyperparameter to control the gradient direction and size; where input x, label y for the loss function The gradient of is written as:

[0015]

[0016] The specific iterative step algorithm is as follows:

[0017] For the original input sample x and the corresponding label y, select the patch p0 for training; in the N / m iterations, update the patch in each round; in each round, the first step is to cover the image x with the patch to get a new face image, and then simulate wearing a mask; the second step is to calculate the loss value through the loss function L(x0, y, θ); the third step is to calculate the gradient corresponding to the loss function The fourth step is to update the model parameters θ by the stochastic gradient descent method. The update formula is: Update the gradient of the input x through the updated θ to obtain the gradient direction of the updated adversarial patch Finally, the gradient direction unit value is accumulated on the original patch, that is, p0←p0+∈·sign(g adv ); Repeat the fourth step m times until the gradient descent ends;

[0018] The total loss function is:

[0019]

[0020] Where P adv represents the generated adversarial patch, P0 represents the initial patch without iteration, random noise is selected here, x represents the input face image, and x t Represents the target audience;

[0021] A similar loss function for targeted attacks is written as:

[0022] l tsim (P adv ,x,x t )=cos(em(T(P adv , x)), em(x t ))

[0023] Where em(...) represents the mapping vector (Embedding) from the image input to the output of the face recognition network, T(...) represents the transformation operation that transfers the patch to the face, and cos(...) is the cosine distance between vectors; for non-directional attacks, the form of the similarity loss function is:

[0024] l utsim (P adv ,x,x t )=-cos(em(T(P adv , x), em(x))

[0025] The network is induced to misjudge by minimizing the cosine distance between the generated mapping vector and the target vector; the style loss is expressed as the difference between the Gram matrix of the generated patch and the initial patch:

[0026]

[0027] Where G(...) is the Gram matrix, which is used to represent a specific graph structure and calculate correlation coefficients. It describes the relationship between nodes in the graph and the structure of an internal network layer. The Gram matrix is ​​used to keep the style of the patch from the original. The original Gram matrix needs to iterate from the bottom layer to the top layer of the network, and each time the input of the highest layer is brought into the loss to participate in the iteration together.

[0028] The beneficial effect of the present invention is that the adversarial sample attack method based on the adversarial mask patch proposed by the present invention proposes a mask shape that is more suitable for the face recognition model and a concealment generation method that is more suitable for the application scenario compared to the general adversarial patch method, thereby improving the attack robustness of such methods and increasing the possibility of successful attacks in the real world. The main innovation of the present invention is to design a method for generating disturbances for the face recognition system. The relevant loss function enhances the concealment of the patch by targeting the dependence of the face recognition network on the embedding vector and by designing the style loss link, thereby greatly improving the possibility of attacking the real system. For example, in real life, an attacker can impersonate other identities for face verification, and then steal other people's account information after passing. This attack method proposes a concealment-related evaluation standard for defense.

[0029] Compared with adversarial samples of general attack classification types, this method can better utilize the information of the face recognition network to generate more targeted method patches. For attack data such as face recognition algorithms with large inter-class distances but small intra-class distances, a loss function that is more suitable for the face recognition model can better complete the attack in reality. With better attack effects, new breakthroughs can be brought to the fields of adversarial defense and adversarial training.

[0030] Compared with the classification attack patch of related face methods, the new concealment method of this method can better patch, so it can more effectively target the face recognition system in the real world. With the assistance of style loss and smoothness loss, the target feature information can be more softly hidden in the surrounding pixel information, so that the effect is more natural and concealed.

[0031] Other advantages, objectives and features of the present invention will be described in the following description to some extent, and to some extent, will be obvious to those skilled in the art based on the following examination and study, or can be taught from the practice of the present invention. The objectives and other advantages of the present invention can be realized and obtained through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention will be described in detail below in conjunction with the accompanying drawings, wherein:

[0033] Figure 1 The overall flow chart of the single-step iterative adversarial training method with enhanced perturbation diversity;

[0034] Figure 2 Experiment on mask similarity against non-directional attack;

[0035] Figure 3 Experiment on mask similarity for targeted attack;

[0036] Figure 4 This is a mobility comparison test between models. DETAILED DESCRIPTION

[0037] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments only illustrate the basic concept of the present invention in a schematic manner, and the following embodiments and features in the embodiments can be combined with each other without conflict.

[0038] Among them, the drawings are only used for illustrative explanations, and they only represent schematic diagrams rather than actual pictures, and should not be understood as limitations on the present invention. In order to better illustrate the embodiments of the present invention, some parts of the drawings may be omitted, enlarged or reduced, and do not represent the size of actual products. For those skilled in the art, it is understandable that some well-known structures and their descriptions in the drawings may be omitted.

[0039] The same or similar numbers in the drawings of the embodiments of the present invention correspond to the same or similar parts; in the description of the present invention, it should be understood that if the terms "upper", "lower", "left", "right", "front", "rear", etc. indicate the orientation or position relationship, they are based on the orientation or position relationship shown in the drawings, which is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation. Therefore, the terms describing the position relationship in the drawings are only used for illustrative purposes and cannot be understood as limiting the present invention. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to specific circumstances.

[0040] A method for attacking adversarial samples based on adversarial mask patches, characterized by comprising the following steps:

[0041] Step S1: Select random patches for preprocessing, cut out the mask shape and splice it with the input class original image, and simulate the image of the mask on the face as the initial input.

[0042] Step S2: The generated image and the original image are submitted to the network for feature extraction, and the mapping vector outputs of the two images are obtained respectively, and the eigenvalues ​​are recorded.

[0043] Step S3: Substitute the output vector of the adversarial patch synthesized image and the output vector of the real class into the loss function calculation, update the patch pixels through the gradient direction and generate a new adversarial patch.

[0044] Step S4: Repeat the first step until the set iteration number threshold is reached, and output the final adversarial patch.

[0045] Furthermore, the iterative method is to repeat the training for each image x m times in a row, and reuse the gradient of the previous step when calculating the perturbation r. In order to ensure speed and enhance concealment, the entire epoch will be divided by m. The update formula of r is:

[0046] r t+1 =r t +∈·sign(g),

[0047] Where sign(g) represents the gradient direction, and ∈ is a preset hyperparameter to control the gradient direction and magnitude. The gradient of can be written as

[0048]

[0049] This iterative method can effectively prevent the patch from over-satisfying the gradient direction, which would cause the image to be too similar to the target features, thereby reducing the concealment of the attack method.

[0050] The specific iterative step algorithm is as follows:

[0051]

[0052] The overall loss function can be written as

[0053]

[0054] Where P adv represents the generated adversarial patch, P0 represents the initial patch without iteration, random noise is selected here, x represents the input face image, and x t Represents the target object.

[0055] A similar loss function for targeted attacks can be written as

[0056] l utsim (P adv ,x,x t )=cos(em(T(P adv , x), em(x t ))

[0057] Where em(...) represents the mapping vector (Embedding) from the image input to the output of the face recognition network, T(...) represents the transformation operation that transfers the patch to the face, and cos(...) is the cosine distance between vectors. For non-directional attacks, the form of the similarity loss function is:

[0058] lutsim (P adv ,x,x t )=-cos(em(T(P adv , x)), em(x))

[0059] The network is induced to misjudge by minimizing the cosine distance between the generated mapping vector and the target vector. The style loss can be expressed as the difference between the Gram matrix of the generated patch and the initial patch:

[0060]

[0061] Where G(...) is the Gram matrix, which is a matrix used to represent a specific graph structure and calculate correlation coefficients. It can describe the relationship between nodes in the graph and is used to describe the structure of an internal network layer. The Gram matrix is ​​used here to keep the patch from the original style, thereby enhancing the anonymity of the method. The original Gram matrix needs to iterate from the bottom layer to the top layer of the network. Since this method itself needs to be repeatedly input to the network to update the patch, each time only the input of the highest layer needs to be brought into the loss to participate in the iteration together.

[0062] Embodiment 1

[0063] like Figure 1 As shown, it is an overall flow chart of the adversarial sample attack method based on adversarial mask patches of the present invention. In order to verify the effectiveness of the method, we designed experiments on related concealment and similarity tests.

[0064] According to relevant experimental needs, the present invention proposes relevant evaluation indicators:

[0065] Cosine similarity: A very important metric for measuring face recognition, it verifies identity by measuring the cosine distance between the feature vectors in two face images. In the experiment of this article, the facial features of the face are extracted and the cosine distance is calculated to measure the reliability of the generated adversarial samples. This evaluation method is used in both the physical world and digital world experiments in this article to verify the attack capability of the mask.

[0066] Attack success rate: an indicator to measure whether the overall method is successful. In physical world experiments, the recognition rate cannot be guaranteed, and there are many invalid screenshots in a frame of video. Therefore, it is necessary to conduct batch experiments on multiple groups of pictures and measure whether the overall system can attack successfully by counting the number of pictures whose similarity passes a specific threshold to the total number of pictures in the statistical batch. For targeted attacks, the expression of the success rate can be written as:

[0067]

[0068] Where I represents the test sample image, Represents the attack target image.

[0069] Peak Signal-to-Noise Ratio: Since the digital world method is committed to ensuring the effectiveness of patch attacks while improving sample concealment, measuring concealment is still a very important indicator. This paper uses the peak signal-to-noise ratio to compare the clean image X and the adversarial patch noise image Y. First, define the mean square error of two input mxn images as:

[0070]

[0071] The peak signal-to-noise ratio expression is given on the basis:

[0072]

[0073] in It is the maximum possible pixel value in the image. Here, each pixel is represented by 8 bits of binary, and the maximum pixel value is 255. For color images, it is necessary to calculate the PSNR values ​​of the three RGB channels separately and then take the average value to obtain the final signal-to-noise ratio.

[0074] Method concealment experiment

[0075] For the concealment experiment, we selected the ResNet-18 backbone network in the pre-trained model using the MS-Celeb-1M face dataset. The parameter settings during the entire training process were batch size 64, learning rate initialization 0.01, and the number of iterations and epochs were set to 100. All experiments in this article were run on the NVIDIA Tesla V100 server. The main deep learning framework was Pytorch 1.7, and the image processing framework was OpenCV 4.5.2. After iteration, adversarial masks were generated for concealment testing. We conducted three experiments on three different random number seeds and took the average of the three experimental results as the final result. The data indicator results are shown in Table 1.

[0076] As can be seen from Table 1, the patch can still maintain a certain concealment effect after a sufficient number of iterations. For the adversarial sample methods of the patch type, they all need to try their best to make the patch contain characteristic information that misleads the network so that it is easy to be exposed. The test of this experiment is based on the random perturbation of the initial words as a benchmark for comparison, and the concealment loss of this method is used to hide the characteristics generated by the iteration. Figure 3The first column is the face image wearing the adversarial patch mask, the second column is the face image wearing the random perturbation initial patch, and the third column is the original image in the database. The first column in Table 1 is the PSRN value score of the original image after wearing the adversarial mask, and the second column is the PSRN score of the original image after wearing the random mask. The signal-to-noise ratio score of the blue mask is about 20, which simulates the general difference between the human eye and whether the face is wearing a mask.

[0077] Method similarity experiment

[0078] Through the above experimental analysis, this paper proposes a relatively successful adversarial patch method in terms of concealment. Under the premise that the sample has strong concealment, the similarity score comparison is carried out. The experiment is conducted on the first thousand categories of CASIA-WebFace, and the cosine similarity of the original sample, the randomly perturbed sample and the adversarial mask patch sample method is compared with the true category. The following is obtained: Figure 2 and Figure 3 result.

[0079] Figure 2 and Figure 3 The horizontal axis in represents the type of mask, from left to right, No. 0 no mask, No. 1 adversarial mask, No. 2 random perturbation mask, and No. 3 white mask. The vertical axis represents the cosine similarity score of the sample tested in the network. The green point is an outlier, which represents the number of sample result values ​​that deviate from the distribution of most samples. From the experimental results, it can be seen that adversarial masks and random perturbation masks have better attack effects, and have better effects than random perturbations for targeted attack methods. Because in non-directional attacks, the categories of attack targets are more complex and diverse, random noise is more likely to hit some features and cause interference, but in targeted attacks, the target domain required by the experiment is limited and the success rate is low. The non-directional attack method in this paper can reduce the accuracy of the face recognition model to the range of [0.2, 0.4], and the similarity above the original 0.5 is significantly reduced in attack effect; the non-directional attack can induce the original erroneous [0.2, 0.3] similarity value to above 0.5.

[0080] Migration test experiments were conducted on ArcFace, CosFace and MegFace models under all backbone networks. The backbone network for mask generation is based on ResNet50. The experimental results under different backbone networks and different face recognition models are as follows: Figure 4, where the x-coordinate represents the type of the attack patch mask, from left to right they are adversarial masks, randomly perturbed masks, blue masks, and original images without masks, the y-coordinate represents the network model category, from bottom to top they are ArcFace-ResNet18, CosFace-ResNet18, ArcFace-ResNet34, CosFace-ResNet34, ArcFace-ResNet50, CosFace-ResNet50, ArcFace-ResNet101, CosFace-ResNet101, MegFace-ResNet101, and the z-coordinate represents the similarity score. It can be seen from the experimental results that the adversarial patches trained on the backbone network based on ResNet50 can show effective attack capabilities between models. In particular, it can be found that the attack effect is slightly better when the depth of the ResNet network model is deeper, that is, for each mask type there is a similarity score that decreases with increasing depth. This situation is also common in attack methods. After deeper network iterations, the error obtained each time will deepen as the number of layers is updated. In particular, when the ResNet50 backbone network is used, the attack belongs to the white-box attack method, which is more prominent in the performance of the attack effect. When the method attacks other categories of models of other backbone networks, the attack method belongs to the black-box method, and the attack results also have good scores. Since the attack loss function of this method is based on the cosine distance between network output vectors, this method is mostly a common processing method for face recognition models, so there is a certain degree of migration between methods.

[0081] Table 1 Concealment PSNR index score

[0082]

[0083]

[0084] The above experiments and related result analysis verify the effectiveness of the adversarial training method proposed in this invention.

[0085] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solution, which should be included in the scope of the claims of the present invention.

Claims

1. A method for countering patch attacks against face recognition, characterized in that: The method comprises the following steps: S1: Select random patches for preprocessing, cut out the mask shape and splice it with the input class original image, and simulate the image of the mask on the face as the initial input; S2: The generated image and the original image are submitted to the network for feature extraction, and the mapping vector outputs of the two images are obtained respectively, and the eigenvalues ​​are recorded; S3: Substitute the output vector of the synthetic image of the adversarial patch and the output vector of the real class into the loss function calculation, update the patch pixels according to the gradient direction and generate a new adversarial patch; S4: Iterate, repeat the first step until the set iteration number threshold is reached, and output the final adversarial patch; In S4, the iteration method is to repeat the training for each image x m times continuously, and reuse the gradient of the previous step when calculating the perturbation r. To ensure the speed and enhance the concealment, the whole epoch will be divided by m; the update formula of r is: r t+1 =r t +∈·sign(g) Where sign(g) represents the gradient direction, ∈ is a preset hyperparameter to control the gradient direction and magnitude; the gradient of the input x and label y for the loss function L is written as: The specific iterative step algorithm is as follows: For the original input sample x and the corresponding label y, select the initial patch p0 for training; in the N / m iterations, update the patch in each round; in each round, the first step is to cover the image x with the patch to obtain a new face image, thereby simulating wearing a mask; the second step is to calculate the loss value through the loss function L(x0, y, θ); the third step is to calculate the gradient corresponding to the loss function The fourth step is to update the model parameters θ by the stochastic gradient descent method. The update formula is: Update the gradient of the input x through the updated θ to obtain the gradient direction of the updated adversarial patch Finally, the gradient direction unit value is accumulated on the original patch, that is, p0←p0+∈·sign(g adv ); Repeat the fourth step m times until the gradient descent ends; The total loss function is: Where P adv represents the generated adversarial patch, P0 represents the initial patch without iteration, random noise is selected here, x represents the input face image, and x t Represents the target audience; A similar loss function for targeted attacks is written as: the tsim (P adv ,x,x t )=cos(em(T(P adv ,x)),em(x t )) Where em(...) represents the mapping vector (Embedding) from the image input to the output of the face recognition network, T(...) represents the transformation operation that transfers the patch to the face, and cos(...) is the cosine distance between vectors; for non-directional attacks, the form of the similarity loss function is: the utsim (P adv ,x,x t )=-cos(em(T(P adv ,x))em(x)) The network is induced to misjudge by minimizing the cosine distance between the generated mapping vector and the target vector; the style loss is expressed as the difference between the Gram matrix of the generated patch and the initial patch: Where G(...) is a Grammar matrix, which is used to represent a specific graph structure and calculate correlation coefficients. It describes the relationship between nodes in the graph and the structure of an internal network layer. The Grammar matrix is ​​used to keep the patch from its original style. The original Grammar matrix needs to iterate from the bottom layer to the top layer of the network, and each time the input of the highest layer is brought into the loss to participate in the iteration together.

Images